Internal Stakeholder Database

CEMEX INTERNAL STAKEHOLDER DATABASE

Information Notice given under Article 14 of the GDPR

CEMEX informs you of the processing of your personal data in relation to the Cemex Internal Stakeholder Database (the “Internal Database”). In accordance with Article 14 of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter the “GDPR”), CEMEX informs you of the following:

I. DATA CONTROLLER

CEMEX, S.A.B. de C.V. (“CEMEX”), a Mexican publicly traded stock corporation with variable capital that has a registered address at Avenida Ricardo Margain Zozaya #325, Colonia Valle del Campestre, San Pedro Garza Garcia, Nuevo Leon, 66265, Mexico is the controller of your personal information. This means that it determines the purpose for which, and the means by which, your personal information is used and it is responsible for handling your information in accordance with GDPR.

II. CONTACT POINT

CEMEX has a Chief Privacy Officer, as well as Data Protection Officers in European countries where we have operations. You may contact CEMEX’s data privacy office at any time if you have questions, general concerns about the processing of your personal information, or any data protection issue, by sending an e-mail to dataprivacy@cemex.com.

III. PURPOSE OF PROCESSING PERSONAL DATA AND LEGAL BASIS

Your personal data has been included in our database for the purpose of maintaining a clear and updated record of our key contacts. We rely on article 6 (1) (f) of the GDPR to process your personal information. We have a legitimate interest in using your information in the ways described above so that we are able to effectively manage CEMEX’s relations with its key stakeholders on a global level.

IV. CATEGORIES OF PERSONAL DATA

We will process the following categories of your personal data: job title, current job position, business address, business e-mail and business telephone number. We will not process any sensitive information which may be deemed a special category of personal data under GDPR.

V. RECIPIENTS OF PERSONAL DATA

We will not transfer your personal information to third parties, only to CEMEX affiliates located in any country in which we operate and pursuant to any applicable GDPR safeguard, as the Internal Database is strictly for internal CEMEX use.

VI. DATA RETENTION

Your personal data will be retained as long as is reasonably necessary to fulfill the purposes mentioned above. The Internal Database will be updated at least every 6 months, and we will automatically eliminate any personal information from the Internal Database of any person that we identify to have ceased to be a key CEMEX stakeholder.

VII. DATA SUBJECT RIGHTS

You may review, correct, update or request to be deleted from our Internal Database by contacting us at dataprivacy@cemex.com. You have the right to:

1. Request access to your personal information. You can request to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
2. Request correction of your personal information. You can ask us to correct any incomplete or inaccurate information we hold about you. We encourage you to provide us with accurate personal information and to let us know if your personal information changes. We will not assume any liability in respect of incorrect personal information you provide to us.
3. Request erasure of your personal information. You can request to delete or remove personal information where there is no good reason for us to continue using or storing it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to us using it, as described below.
4. Object to our use of your personal information where we are relying on our legitimate interest (or those of a third party) to do so and there is something about your particular situation which makes you want to object to us using it on this ground.
5. Request restriction of the use of your personal information. You can ask us to suspend the use of your personal information, for example if you want us to establish its accuracy.
6. Request the transfer of your personal information in an accessible format to you or another organization.

If you would like to exercise any of the above rights, please contact us at dataprivacy@cemex.com.

VIII. RIGHT TO LODGE A COMPLAINT WITH A SUPERVISORY AUTHORITY

If you feel that we have not answered your concerns appropriately you have the right to make a complaint to your local data protection authority. Contact details for EU data protection authorities can be found here.

IX. SOURCES OF PERSONAL DATA

We obtain the personal data that we include in the Internal Database mainly from publicly accessible sources, but also from business cards given to CEMEX employees or to CEMEX affiliates employees, or from our customer database.

X. AUTOMATED DECISION-MAKING

We do not envisage that any decisions will be taken about you using automated means.